5.8
高危
60 个模型检测该样本为恶意！
重新分析
更多

8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b

e003ceeef6a45f3fe2d6b652d77816c8.exe

分析耗时

23s

最近分析

文件大小

909.0KB
静态报毒 动态报毒 4GW@AAEZNFHI AI SCORE=86 AIDETECTVM ALI2000015 AUTO AVSARHER BT8I9P CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO EMOP EMOY FAREIT FQHQV GENETIC HIGH CONFIDENCE HNBRIZ HPLOKI KCLOUD MALWARE1 MALWARE@#AFXFG1L4TTFJ SCORE SIGGEN2 SMBD TSCOPE TSGENERIC TSPY UNSAFE X2079 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!E003CEEEF6A4 20201211 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619948413.770907
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34602820
registers.edi: 0
registers.eax: 0
registers.ebp: 34602888
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 3271753728
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64
exception.symbol: e003ceeef6a45f3fe2d6b652d77816c8+0x5d9ce
exception.instruction: div eax
exception.module: e003ceeef6a45f3fe2d6b652d77816c8.exe
exception.exception_code: 0xc0000094
exception.offset: 383438
exception.address: 0x45d9ce
success 0 0
1619962501.165373
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
e003ceeef6a45f3fe2d6b652d77816c8+0x90a4d @ 0x490a4d
e003ceeef6a45f3fe2d6b652d77816c8+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2f14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619948413.442907
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619948413.770907
NtProtectVirtualMemory
process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045d000
success 0 0
1619948413.786907
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x008a0000
success 0 0
1619962500.165373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619962500.212373
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e50000
success 0 0
1619962500.212373
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fb0000
success 0 0
1619962500.212373
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 557056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e50000
success 0 0
1619962500.212373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 520192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e52000
success 0 0
1619962500.525373
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02180000
success 0 0
1619962500.525373
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022f0000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.087373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619962501.103373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.103373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619962501.118373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.134373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619962501.134373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619962501.134373
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.316832840341617 section {'size_of_data': '0x00072c00', 'virtual_address': '0x00076000', 'entropy': 7.316832840341617, 'name': '.rsrc', 'virtual_size': '0x00072a38'} description A section with a high entropy has been found
entropy 0.5055066079295154 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1108 called NtSetContextThread to modify thread in remote process 3048
Time & API Arguments Status Return Repeated
1619948414.192907
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3048
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1108 resumed a thread in remote process 3048
Time & API Arguments Status Return Repeated
1619948414.520907
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3048
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619948414.067907
CreateProcessInternalW
thread_identifier: 3056
thread_handle: 0x000000fc
process_identifier: 3048
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e003ceeef6a45f3fe2d6b652d77816c8.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619948414.067907
NtUnmapViewOfSection
process_identifier: 3048
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619948414.130907
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3048
commit_size: 1167360
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1167360
base_address: 0x00400000
success 0 0
1619948414.192907
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619948414.192907
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3048
success 0 0
1619948414.520907
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3048
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.e003ceeef6a45f3f
McAfee Fareit-FTB!E003CEEEF6A4
Malwarebytes Trojan.MalPack.DLF
Zillya Dropper.Agent.Win32.430725
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
Cybereason malicious.c72ace
Arcabit Trojan.Delf.FareIt.Gen.7
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Fareit-8723799-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Crypt.hnbriz
Avast Win32:Malware-gen
Rising Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware Trojan.Delf.FareIt.Gen.7
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Comodo Malware@#afxfg1l4ttfj
F-Secure Trojan.TR/Injector.fqhqv
DrWeb Trojan.PWS.Siggen2.51483
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Sophos Mal/Generic-S
Avira TR/Injector.fqhqv
Antiy-AVL Trojan/Win32.TSGeneric
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AO!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 90)
AhnLab-V3 Suspicious/Win.Delphiless.X2079
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.4GW@aaeZnFhi
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=86)
VBA32 TScope.Trojan.Delf
Cylance Unsafe
Zoner Trojan.Win32.91477
ESET-NOD32 a variant of Win32/Injector.EMOP
TrendMicro-HouseCall TSPY_HPLOKI.SMBD
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46a13c VirtualFree
• 0x46a140 VirtualAlloc
• 0x46a144 LocalFree
• 0x46a148 LocalAlloc
• 0x46a14c GetVersion
• 0x46a150 GetCurrentThreadId
• 0x46a15c VirtualQuery
• 0x46a160 WideCharToMultiByte
• 0x46a164 MultiByteToWideChar
• 0x46a168 lstrlenA
• 0x46a16c lstrcpynA
• 0x46a170 LoadLibraryExA
• 0x46a174 GetThreadLocale
• 0x46a178 GetStartupInfoA
• 0x46a17c GetProcAddress
• 0x46a180 GetModuleHandleA
• 0x46a184 GetModuleFileNameA
• 0x46a188 GetLocaleInfoA
• 0x46a18c GetCommandLineA
• 0x46a190 FreeLibrary
• 0x46a194 FindFirstFileA
• 0x46a198 FindClose
• 0x46a19c ExitProcess
• 0x46a1a0 WriteFile
• 0x46a1a8 RtlUnwind
• 0x46a1ac RaiseException
• 0x46a1b0 GetStdHandle
Library user32.dll:
• 0x46a1b8 GetKeyboardType
• 0x46a1bc LoadStringA
• 0x46a1c0 MessageBoxA
• 0x46a1c4 CharNextA
Library advapi32.dll:
• 0x46a1cc RegQueryValueExA
• 0x46a1d0 RegOpenKeyExA
• 0x46a1d4 RegCloseKey
Library oleaut32.dll:
• 0x46a1dc SysFreeString
• 0x46a1e0 SysReAllocStringLen
• 0x46a1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46a1ec TlsSetValue
• 0x46a1f0 TlsGetValue
• 0x46a1f4 LocalAlloc
• 0x46a1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46a200 RegQueryValueExA
• 0x46a204 RegOpenKeyExA
• 0x46a208 RegCloseKey
Library kernel32.dll:
• 0x46a210 lstrcpyA
• 0x46a214 WriteFile
• 0x46a218 WaitForSingleObject
• 0x46a21c VirtualQuery
• 0x46a220 VirtualProtectEx
• 0x46a224 VirtualAlloc
• 0x46a228 Sleep
• 0x46a22c SizeofResource
• 0x46a230 SetThreadLocale
• 0x46a234 SetFilePointer
• 0x46a238 SetEvent
• 0x46a23c SetErrorMode
• 0x46a240 SetEndOfFile
• 0x46a244 ResetEvent
• 0x46a248 ReadFile
• 0x46a24c MulDiv
• 0x46a250 LockResource
• 0x46a254 LoadResource
• 0x46a258 LoadLibraryA
• 0x46a264 GlobalUnlock
• 0x46a268 GlobalReAlloc
• 0x46a26c GlobalHandle
• 0x46a270 GlobalLock
• 0x46a274 GlobalFree
• 0x46a278 GlobalFindAtomA
• 0x46a27c GlobalDeleteAtom
• 0x46a280 GlobalAlloc
• 0x46a284 GlobalAddAtomA
• 0x46a288 GetVersionExA
• 0x46a28c GetVersion
• 0x46a290 GetTickCount
• 0x46a294 GetThreadLocale
• 0x46a298 GetSystemInfo
• 0x46a29c GetStringTypeExA
• 0x46a2a0 GetStdHandle
• 0x46a2a4 GetProcAddress
• 0x46a2a8 GetModuleHandleA
• 0x46a2ac GetModuleFileNameA
• 0x46a2b0 GetLocaleInfoA
• 0x46a2b4 GetLocalTime
• 0x46a2b8 GetLastError
• 0x46a2bc GetFullPathNameA
• 0x46a2c0 GetFileType
• 0x46a2c4 GetFileAttributesA
• 0x46a2c8 GetDiskFreeSpaceA
• 0x46a2cc GetDateFormatA
• 0x46a2d0 GetCurrentThreadId
• 0x46a2d4 GetCurrentProcessId
• 0x46a2d8 GetCurrentProcess
• 0x46a2dc GetCPInfo
• 0x46a2e0 GetACP
• 0x46a2e4 FreeResource
• 0x46a2e8 InterlockedExchange
• 0x46a2ec FreeLibrary
• 0x46a2f0 FormatMessageA
• 0x46a2f4 FindResourceA
• 0x46a2f8 FindFirstFileA
• 0x46a2fc FindClose
• 0x46a308 EnumCalendarInfoA
• 0x46a314 CreateThread
• 0x46a318 CreateFileA
• 0x46a31c CreateEventA
• 0x46a320 CompareStringA
• 0x46a324 CloseHandle
Library version.dll:
• 0x46a32c VerQueryValueA
• 0x46a334 GetFileVersionInfoA
Library gdi32.dll:
• 0x46a33c UnrealizeObject
• 0x46a340 StretchBlt
• 0x46a344 SetWindowOrgEx
• 0x46a348 SetWinMetaFileBits
• 0x46a34c SetViewportOrgEx
• 0x46a350 SetTextColor
• 0x46a354 SetStretchBltMode
• 0x46a358 SetROP2
• 0x46a35c SetPixel
• 0x46a360 SetEnhMetaFileBits
• 0x46a364 SetDIBColorTable
• 0x46a368 SetBrushOrgEx
• 0x46a36c SetBkMode
• 0x46a370 SetBkColor
• 0x46a374 SelectPalette
• 0x46a378 SelectObject
• 0x46a37c SelectClipRgn
• 0x46a380 SaveDC
• 0x46a384 RestoreDC
• 0x46a388 Rectangle
• 0x46a38c RectVisible
• 0x46a390 RealizePalette
• 0x46a394 Polyline
• 0x46a398 PlayEnhMetaFile
• 0x46a39c PatBlt
• 0x46a3a0 MoveToEx
• 0x46a3a4 MaskBlt
• 0x46a3a8 LineTo
• 0x46a3ac IntersectClipRect
• 0x46a3b0 GetWindowOrgEx
• 0x46a3b4 GetWinMetaFileBits
• 0x46a3b8 GetTextMetricsA
• 0x46a3c4 GetStockObject
• 0x46a3c8 GetPixel
• 0x46a3cc GetPaletteEntries
• 0x46a3d0 GetObjectA
• 0x46a3dc GetEnhMetaFileBits
• 0x46a3e0 GetDeviceCaps
• 0x46a3e4 GetDIBits
• 0x46a3e8 GetDIBColorTable
• 0x46a3ec GetDCOrgEx
• 0x46a3f4 GetClipRgn
• 0x46a3f8 GetClipBox
• 0x46a3fc GetBrushOrgEx
• 0x46a400 GetBitmapBits
• 0x46a404 ExcludeClipRect
• 0x46a408 DeleteObject
• 0x46a40c DeleteEnhMetaFile
• 0x46a410 DeleteDC
• 0x46a414 CreateSolidBrush
• 0x46a418 CreateRectRgn
• 0x46a41c CreatePenIndirect
• 0x46a420 CreatePalette
• 0x46a428 CreateFontIndirectA
• 0x46a42c CreateDIBitmap
• 0x46a430 CreateDIBSection
• 0x46a434 CreateCompatibleDC
• 0x46a43c CreateBrushIndirect
• 0x46a440 CreateBitmap
• 0x46a444 CopyEnhMetaFileA
• 0x46a448 BitBlt
Library user32.dll:
• 0x46a450 CreateWindowExA
• 0x46a454 WindowFromPoint
• 0x46a458 WinHelpA
• 0x46a45c WaitMessage
• 0x46a460 UpdateWindow
• 0x46a464 UnregisterClassA
• 0x46a468 UnhookWindowsHookEx
• 0x46a46c TranslateMessage
• 0x46a474 TrackPopupMenu
• 0x46a47c ShowWindow
• 0x46a480 ShowScrollBar
• 0x46a484 ShowOwnedPopups
• 0x46a488 ShowCursor
• 0x46a48c SetWindowsHookExA
• 0x46a490 SetWindowPos
• 0x46a494 SetWindowPlacement
• 0x46a498 SetWindowLongA
• 0x46a49c SetTimer
• 0x46a4a0 SetScrollRange
• 0x46a4a4 SetScrollPos
• 0x46a4a8 SetScrollInfo
• 0x46a4ac SetRect
• 0x46a4b0 SetPropA
• 0x46a4b4 SetParent
• 0x46a4b8 SetMenuItemInfoA
• 0x46a4bc SetMenu
• 0x46a4c0 SetForegroundWindow
• 0x46a4c4 SetFocus
• 0x46a4c8 SetCursor
• 0x46a4cc SetClassLongA
• 0x46a4d0 SetCapture
• 0x46a4d4 SetActiveWindow
• 0x46a4d8 SendMessageA
• 0x46a4dc ScrollWindow
• 0x46a4e0 ScreenToClient
• 0x46a4e4 RemovePropA
• 0x46a4e8 RemoveMenu
• 0x46a4ec ReleaseDC
• 0x46a4f0 ReleaseCapture
• 0x46a4fc RegisterClassA
• 0x46a500 RedrawWindow
• 0x46a504 PtInRect
• 0x46a508 PostQuitMessage
• 0x46a50c PostMessageA
• 0x46a510 PeekMessageA
• 0x46a514 OffsetRect
• 0x46a518 OemToCharA
• 0x46a51c MessageBoxA
• 0x46a520 MapWindowPoints
• 0x46a524 MapVirtualKeyA
• 0x46a528 LoadStringA
• 0x46a52c LoadKeyboardLayoutA
• 0x46a530 LoadIconA
• 0x46a534 LoadCursorA
• 0x46a538 LoadBitmapA
• 0x46a53c KillTimer
• 0x46a540 IsZoomed
• 0x46a544 IsWindowVisible
• 0x46a548 IsWindowEnabled
• 0x46a54c IsWindow
• 0x46a550 IsRectEmpty
• 0x46a554 IsIconic
• 0x46a558 IsDialogMessageA
• 0x46a55c IsChild
• 0x46a560 InvalidateRect
• 0x46a564 IntersectRect
• 0x46a568 InsertMenuItemA
• 0x46a56c InsertMenuA
• 0x46a570 InflateRect
• 0x46a578 GetWindowTextA
• 0x46a57c GetWindowRect
• 0x46a580 GetWindowPlacement
• 0x46a584 GetWindowLongA
• 0x46a588 GetWindowDC
• 0x46a58c GetTopWindow
• 0x46a590 GetSystemMetrics
• 0x46a594 GetSystemMenu
• 0x46a598 GetSysColorBrush
• 0x46a59c GetSysColor
• 0x46a5a0 GetSubMenu
• 0x46a5a4 GetScrollRange
• 0x46a5a8 GetScrollPos
• 0x46a5ac GetScrollInfo
• 0x46a5b0 GetPropA
• 0x46a5b4 GetParent
• 0x46a5b8 GetWindow
• 0x46a5bc GetMenuStringA
• 0x46a5c0 GetMenuState
• 0x46a5c4 GetMenuItemInfoA
• 0x46a5c8 GetMenuItemID
• 0x46a5cc GetMenuItemCount
• 0x46a5d0 GetMenu
• 0x46a5d4 GetLastActivePopup
• 0x46a5d8 GetKeyboardState
• 0x46a5e0 GetKeyboardLayout
• 0x46a5e4 GetKeyState
• 0x46a5e8 GetKeyNameTextA
• 0x46a5ec GetIconInfo
• 0x46a5f0 GetForegroundWindow
• 0x46a5f4 GetFocus
• 0x46a5f8 GetDlgItem
• 0x46a5fc GetDesktopWindow
• 0x46a600 GetDCEx
• 0x46a604 GetDC
• 0x46a608 GetCursorPos
• 0x46a60c GetCursor
• 0x46a610 GetClipboardData
• 0x46a614 GetClientRect
• 0x46a618 GetClassNameA
• 0x46a61c GetClassInfoA
• 0x46a620 GetCapture
• 0x46a624 GetActiveWindow
• 0x46a628 FrameRect
• 0x46a62c FindWindowA
• 0x46a630 FillRect
• 0x46a634 EqualRect
• 0x46a638 EnumWindows
• 0x46a63c EnumThreadWindows
• 0x46a640 EndPaint
• 0x46a644 EnableWindow
• 0x46a648 EnableScrollBar
• 0x46a64c EnableMenuItem
• 0x46a650 DrawTextA
• 0x46a654 DrawMenuBar
• 0x46a658 DrawIconEx
• 0x46a65c DrawIcon
• 0x46a660 DrawFrameControl
• 0x46a664 DrawFocusRect
• 0x46a668 DrawEdge
• 0x46a66c DispatchMessageA
• 0x46a670 DestroyWindow
• 0x46a674 DestroyMenu
• 0x46a678 DestroyIcon
• 0x46a67c DestroyCursor
• 0x46a680 DeleteMenu
• 0x46a684 DefWindowProcA
• 0x46a688 DefMDIChildProcA
• 0x46a68c DefFrameProcA
• 0x46a690 CreatePopupMenu
• 0x46a694 CreateMenu
• 0x46a698 CreateIcon
• 0x46a69c ClientToScreen
• 0x46a6a0 CheckMenuItem
• 0x46a6a4 CallWindowProcA
• 0x46a6a8 CallNextHookEx
• 0x46a6ac BeginPaint
• 0x46a6b0 CharNextA
• 0x46a6b4 CharLowerBuffA
• 0x46a6b8 CharLowerA
• 0x46a6bc CharToOemA
• 0x46a6c0 AdjustWindowRectEx
Library kernel32.dll:
• 0x46a6cc Sleep
Library oleaut32.dll:
• 0x46a6d4 SafeArrayPtrOfIndex
• 0x46a6d8 SafeArrayGetUBound
• 0x46a6dc SafeArrayGetLBound
• 0x46a6e0 SafeArrayCreate
• 0x46a6e4 VariantChangeType
• 0x46a6e8 VariantCopy
• 0x46a6ec VariantClear
• 0x46a6f0 VariantInit
Library comctl32.dll:
• 0x46a700 ImageList_Write
• 0x46a704 ImageList_Read
• 0x46a714 ImageList_DragMove
• 0x46a718 ImageList_DragLeave
• 0x46a71c ImageList_DragEnter
• 0x46a720 ImageList_EndDrag
• 0x46a724 ImageList_BeginDrag
• 0x46a728 ImageList_Remove
• 0x46a72c ImageList_DrawEx
• 0x46a730 ImageList_Replace
• 0x46a734 ImageList_Draw
• 0x46a744 ImageList_Add
• 0x46a74c ImageList_Destroy
• 0x46a750 ImageList_Create
Library comdlg32.dll:
• 0x46a758 GetSaveFileNameA
• 0x46a75c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.